/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

2 votes188 views1 answer
Docker: Error response from daemon: dial unix docker.raw.sock: connect: no such file or directory
Shell/Bash
0 vote190 views2 answers
Start Gui on your Ubuntu 20.04 system from cli
Shell/Bash
0 vote204 views1 answer
Pipenv an error occurred while installing psycopg2==2.8.4
Shell/Bash
1 vote179 views1 answer
Digitally signed react native
Shell/Bash
0 vote164 views1 answer
Check login info on mac os
Shell/Bash
1 vote184 views1 answer
PowerShell remove object from array
Shell/Bash
2 votes177 views2 answers
Update python3.10 linux
Shell/Bash
1 vote209 views1 answer
Create private repository github command line
Shell/Bash
1 vote210 views1 answer
Zipalign: command not found mac
Shell/Bash
0 vote282 views1 answer
: Failed to start A high performance web server and a reverse proxy server. -- Subject: A start job for unit nginx.service has failed
Shell/Bash